Studyledge

Data Security, Integrity and Ethics: Question 6

Syllabus 6.1

Multiple choice AS 1 mark

A school stores students' contact details and exam grades in a single database. Three separate incidents occur during one term:

  • Incident 1: A member of staff who has been granted full access to the database looks up the exam grades of a student who is not in any of their classes, purely out of personal curiosity.
  • Incident 2: A software fault during a scheduled backup silently changes some students' exam grades to incorrect values, even though no unauthorised person has accessed the database.
  • Incident 3: An unauthorised outsider guesses a weak administrator password and downloads a copy of the entire database.

Which one of these incidents is best described as a breach of data integrity, as opposed to a breach of privacy or a breach of security?

Choose an answer to check it, then compare with the worked solution below.
Show worked solution Hide worked solution

Worked solution

Why B is correct

Integrity refers specifically to whether data remains accurate, complete and uncorrupted. It is a separate concern from who is allowed to see the data (privacy) or who is allowed to access the system that holds it (security).

In Incident 2, no unauthorised person has viewed or copied anything: the database has not been accessed by anyone who should not have access to it. Instead, a software fault has caused some of the stored exam grades to become wrong. This is exactly what a breach of integrity looks like: the data itself is no longer accurate, regardless of who did or did not access it.

Why the other options are wrong

  • A describes Incident 1, which is a privacy issue: the staff member is authorised to use the database (so there is no security breach) and has not altered any data (so there is no integrity breach), but they have looked at information about a specific student that they have no legitimate need to see.
  • C describes Incident 3, which is a security issue: an unauthorised outsider has broken into the system, but the data itself, once copied, has not been changed or corrupted. It is still accurate, just no longer confidential.
  • D wrongly treats “integrity” as a catch-all term covering any failure to protect data. In fact, security, privacy and integrity are three distinct concerns, and only Incident 2 involves the data itself becoming inaccurate.

Final answer

B. Incident 2 is a breach of integrity because the stored exam grades have become inaccurate, independently of any unauthorised access.